CVE-2007-2223 Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overf...
HighCVSS 9.3
EPSS 48.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft xml core services | = 3.0 | No fix listed |
| Microsoft xml core services | = 4.0 | No fix listed |
| Microsoft xml core services | = 6.0 | No fix listed |
| Microsoft xml core services | = 5.0 | No fix listed |
References
- 20070814 Microsoft XML Core Services XMLDOM Memory Corruption Vulnerability broken-link third-party-advisory
- 26447 third-party-advisory vendor-advisory
- VU#361968 third-party-advisory us-government-resource
- 20070814 ZDI-07-048: Microsoft Internet Explorer substringData() Heap Overflow Vulnerability mailing-list third-party-advisory vdb-entry
- 20070816 MS07-042 XMLDOM substringData() PoC mailing-list third-party-advisory vdb-entry
- 25301 third-party-advisory vdb-entry
- 1018559 third-party-advisory vdb-entry
- ADV-2007-2866 vdb-entry vendor-advisory
- www.zerodayinitiative.com third-party-advisory vdb-entry
- MS07-042 patch vendor-advisory
- oval:org.mitre.oval:def:2069 signature third-party-advisory vdb-entry